Re: Prewikka not reporting agents or events

Okay, if you installed in the normal location /usr/local.  What does
/usr/local/etc/prelude/default/client.conf have for server-addr= ?

Also, if you start snort not in daemon mode, it should print to the screen
either that it successfully connected to the prelude-manager, or the error.
This is assuming you have the output prelude line referencing your
registered profile in your snort.conf.

On Thu, Nov 20, 2008 at 10:15 AM, Jason Dixon <[email protected]> wrote:

> On Thu, Nov 20, 2008 at 09:23:48AM -0500, ScottO wrote:
> > On Thu, Nov 20, 2008 at 12:39 AM, Jason Dixon <[email protected]> wrote:
> > > On Thu, Nov 20, 2008 at 10:01:32AM +0530, rinku buragohain wrote:
> > > > On Thu, Nov 20, 2008 at 3:20 AM, Jason Dixon <[email protected]>
> wrote:
> > > >
> > > > > I'm having some difficulty with Prewikka not showing any events or
> > > > > agents.  I built libprelude, libpreludedb, prelude-lml, and
> > > > > prelude-manager from source on our CentOS 5.2 snort server.  I also
> > > > > rebuilt snort with --enable-prelude from the official Snort spec
> > > > > file.  Prewikka works fine, as does snort (logging to file).  I
> used
> > > > > prelude-admin to register a "snort" profile and enabled this
> profile in
> > > > > snort.conf.  I don't see where snort is attempting to connect to
> > > > > prelude-manager, but I don't see any errors either.  Any
> suggestions?
> > > > >
> > > > > P.S.  I noticed that nowhere in the User Manual does it mention
> > > starting
> > > > > the prelude-manager.  I think it assumes that most users will
> install
> > > > > from binary package (although the installation documentation is
> > > > > otherwise excellent).  Is this an oversight by the author, or do I
> not
> > > > > need to start prelude-manager manually?
> > > >
> > > > as per my knowlege prelude manager will be your server and the sensor
> > > will
> > > > be your client.. so to register your sensor to server you have to
> first
> > > run
> > > > the prelude-manager then start the sensor(snort)..just try it
> > >
> > > I must not have communicated very well in my initial post.  I've
> already
> > > started up prelude-manager and have registered the sensor.  I
> configured
> > > snort.conf to use the prelude output and started up snort.  It reports
> > > nothing about connecting (or attempting to connect) to prelude.
> >
> > What is the output of: netstat -anp | grep 4690
>
> $ sudo netstat -anp | grep 4690
> tcp        0      0 127.0.0.1:4690              0.0.0.0:*
> LISTEN      23101/prelude-manag
>
> I had already checked to make sure that it was listening.  But this
> brings up another question I had.  How does a sensor know where to
> connect to the manager?  I know that's what the client configuration in
> the prelude directories are for, but how does the sensor know where to
> find these configurations?  There must be something obvious I'm
> overlooking with regards to the Snort sensor, but the documentation is
> limited there.
>
> Thanks,
>
> --
> Jason Dixon
> OmniTI Computer Consulting, Inc.
> [email protected]
> 443.325.1357 x.241
>
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user